CmdID / PowerShell / Cmdlets / Remove
Remove-Item
Deletes the specified items. PowerShell reference
From the PowerShell reference
13 parameters
Aliases del, erase, rd, ri, rm
2 Sigma rules look for it
What it does
Deletes the specified items. The Remove-Item cmdlet deletes one or more items. Because it's supported by many providers, it can delete many different types of items, including files, folders, registry keys, variables, aliases, and functions.
Remove-Item [-Path] <String[]> [-Filter <String>] [-Include <String[]>] [-Exclude <String[]>] [-Recurse] [-Force] [-Credential <PSCredential>] [-WhatIf] [-Confirm] [-UseTransaction] [-Stream <String[]>] [<CommonParameters>]Remove-Item -LiteralPath <String[]> [-Filter <String>] [-Include <String[]>] [-Exclude <String[]>] [-Recurse] [-Force] [-Credential <PSCredential>] [-WhatIf] [-Confirm] [-UseTransaction] [-Stream <String[]>] [<CommonParameters>]Remove-Item [-Path] <String[]> [-Filter <String>] [-Include <String[]>] [-Exclude <String[]>] [-Recurse] [-Force] [-Credential <PSCredential>] [-WhatIf] [-Confirm] [-UseTransaction] [-DeleteKey] [<CommonParameters>]Remove-Item -LiteralPath <String[]> [-Filter <String>] [-Include <String[]>] [-Exclude <String[]>] [-Recurse] [-Force] [-Credential <PSCredential>] [-WhatIf] [-Confirm] [-UseTransaction] [-DeleteKey] [<CommonParameters>]Remove-Item [-Path] <string[]> [-Filter <string>] [-Include <string[]>] [-Exclude <string[]>] [-Recurse] [-Force] [-Credential <pscredential>] [-WhatIf] [-Confirm] [-UseTransaction] [<CommonParameters>]Remove-Item -LiteralPath <string[]> [-Filter <string>] [-Include <string[]>] [-Exclude <string[]>] [-Recurse] [-Force] [-Credential <pscredential>] [-WhatIf] [-Confirm] [-UseTransaction] [<CommonParameters>]Delete files that have any file extension
Remove-Item C:\Test\*.*IdentifyDelete document files in a folder
Remove-Item * -Include *.doc -Exclude *1*IdentifyDelete hidden, read-only files
Remove-Item -Path C:\Test\hidden-RO-file.txt -ForceIdentifyDelete files in subfolders recursively
Get-ChildItem * -Include *.csv -Recurse | Remove-ItemIdentifyDelete subkeys recursively
Remove-Item HKLM:\Software\MyCompany\OldApp -RecurseIdentifyDeleting files with special characters
Get-ChildItemIdentifyRemove an alternate data stream
Get-Item C:\Test\Copy-Script.ps1 -Stream Zone.IdentifierIdentifyIts page in the reference: Remove-Item.
Parameters
-CredentialNOTE: This parameter isn't supported by any providers installed with PowerShell. To impersonate another user, or elevate your credentials when running this cmdlet, use Invoke-Command.-DeleteKeyThis is a dynamic parameter made available by the Certificate provider. The Certificate provider and this parameter are only available on Windows platforms.
When provided, the cmdlet deletes the private key when the certificate is deleted.
For more information, see about_Certificate_Provider.-ExcludeSpecifies, as a string array, an item or items that this cmdlet excludes in the operation. The value of this parameter qualifies the Path parameter. Enter a path element or pattern, such as *.txt. Wildcard characters are permitted. The Exclude parameter is effective only when the command includes the contents of an item, such as C:\Windows\*, where the wildcard character specifies the contents of the C:\Windows directory.
When using Recurse with Exclude, Exclude only filters results of the current directory. If there are files that match the Exclude pattern in subfolders, those files are removed along with its parent directory.-FilterSpecifies a filter to qualify the Path parameter. The FileSystem provider is the only installed PowerShell provider that supports the use of filters. You can find the syntax for the FileSystem filter language in about_Wildcards. Filters are more efficient than other parameters, because the provider applies them when the cmdlet gets the objects rather than having PowerShell filter the objects after they're retrieved.-ForceForces the cmdlet to remove items that can't otherwise be changed, such as hidden or read-only files or read-only aliases or variables. The cmdlet can't remove constant aliases or variables. Implementation varies from provider to provider. For more information, see about_Providers. Even using the Force parameter, the cmdlet can't override security restrictions.-IncludeSpecifies, as a string array, an item or items that this cmdlet includes in the operation. The value of this parameter qualifies the Path parameter. Enter a path element or pattern, such as "*.txt". Wildcard characters are permitted. The Include parameter is effective only when the command includes the contents of an item, such as C:\Windows\*, where the wildcard character specifies the contents of the C:\Windows directory.-LiteralPathSpecifies a path to one or more locations. The value of LiteralPath is used exactly as it's typed. No characters are interpreted as wildcards. If the path includes escape characters, enclose it in single quotation marks. Single quotation marks tell PowerShell not to interpret any characters as escape sequences.
For more information, see about_Quoting_Rules.-PathSpecifies a path of the items being removed. Wildcard characters are permitted.-RecurseIndicates that this cmdlet deletes the items in the specified locations and in all child items of the locations.
NOTE: Starting in Windows version 1909, specifying the file type in the Path parameter when using the Recurse parameter does recursively discover child items with the given file extension. Use the Get-ChildItem cmdlet to get the desired files , then pipe the results to Remove-Item to delete them. See Example 4 for more information.-StreamThis is a dynamic parameter made available by the FileSystem provider. This parameter is only available on Windows. This parameter can't be used in combination with the Recurse parameter.
You can use Remove-Item to delete an alternative data stream, such as Zone.Identifier. However, it isn't the recommended way to eliminate security checks that block files that are downloaded from the Internet. If you verify that a downloaded file is safe, use the Unblock-File cmdlet.
This parameter was introduced in Windows PowerShell 3.0.
For more information, see about_FileSystem_Provider.-UseTransactionIncludes the command in the active transaction. This parameter is valid only when a transaction is in progress. For more information, see about_Transactions-ConfirmPrompts you for confirmation before running the cmdlet. For more information, see the following articles:
- about_Preference_Variables
- about_Functions_CmdletBindingAttribute-WhatIfShows what would happen if the cmdlet runs. The cmdlet isn't run.What looks for it
mediumIIS WebServer Log Deletion via CommandLine UtilitiesSwachchhanda Shrawan Poudel (Nextron Systems)